3. Pay attention to “Security Group Member Delete” and “Security Group Member Add” events (these are events of adding and removing users from permission groups). “User ID” column shows who made a change, “Event Data” column shows user ID to whom the change was made.http://screencast.com/t/UPH7SQmu83BzTo open user’s profile by its ID use the following trick – append to the course URL following suffix:/_layouts/userdisp.aspx?ID=1&force=1 where replace ID with the ID from the column “Event Data”.